Thanks to this thread I was able today to re-flash two DXGs in demo mode to normal Kindle firmware, so I decided to give something back and share a few tips we found long the way.
Since I do own normal rooted DXG with firmware 3.2.1 I decided to make images for kernel and rootfs as described in http://www.mobileread.com/forums/sho...d.php?t=190149
Than my friend soldered three wires and we connected them to Bus Pirate for reliable serial connection using 115200N1 settings.
I also double checked passwords using framework account and cat /etc/passwd which I then feed into jack the ripper using fiona world list to be sure that it was correct.
I already copied images to Kindle (still in demo mode) using USB mount, and on first kindle I wasn't fast enough to enter into recovery so I decided to dd content while demo mode was running. Kernel (first file) went OK, but while I was coping root filesystem (second file) serial port decided to turn off power on serial port so I got corrupted root filesystem.
I slapped myself because if you examine /etc/init.d/power on Kindle you will notice that you can create file /mnt/us/DO_NOT_KILL_UART which will prevent it or just use
echo 0 > /sys/devices/platform/mxcintuart.0/uart_clk_state
after you log in.
After entering in recovery mode (after few tries) I used 3. Load MMC0 over USB storage (using same root password generated for login) and than on laptop used dd to dump root filesystem to first partition of exported USB disk. Problem solved :-)
One device was registered on demo account, and although it did connect to 3G it returned that account was disabled in web browser. After de-registration and login with existing Amazon account we where able to access web and Amazon web store from device (so serial numbers from demo devices don't seem blacklisted in any way -- thanks Amazon, we really appreciate it).
Thanks again to everyone for all hints and this discussed here.